Pardon the lag, time zones. When I say 'mTLS support for darwin' I mean not looking at a path on disk for a cert, I mean looking in the keychain. This has the enhanced properties of being 1. deliverable by MDM and 2. marked as non-exportable. It all fits under the 'beyondCorp'-ish umbrella of having a proxy be able to determine compliant/managed devices with more accuracy/reliability.